Jailbreak

CrowdStrike Maps LLM Safety Classifier Evasion for Defenders

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 CrowdStrike Blog Oct 07, 2026

CrowdStrike has published research detailing how adversaries can evade LLM safety classifiers through a request-aggregate-bypass methodology, providing defenders with a structured threat model for classifier blind spots. This closes a meaningful gap by giving security teams a named, mappable technique set for auditing the real-world coverage of LLM safety controls they rely on in enterprise deployments. Realising the full defensive benefit requires organisations to mature their AI security testing programmes and move beyond assuming safety classifiers provide sufficient standalone protection.

SynthID Watermarking Weakens LLM Safety Guardrails Under Attack

ATLAS OWASP HIGH ▲ 8.2 Ars Technica Security Sep 18, 2026

New research from Lasso Security reveals that SynthID-Text watermarking, being adopted by major AI platforms including Anthropic's Claude, can alter LLM safety behaviour and increase susceptibility to adversarial prompts. The watermarking mechanism's tournament sampling process introduces unintended side effects that can cause models to follow harmful instructions they would otherwise refuse. The finding is particularly significant for agentic deployments where models invoke external tools, amplifying the potential blast radius of guardrail bypasses.

LLM Safety Circuits Found in Just 50 Neurons by Unit 42

ATLAS OWASP HIGH ▲ 8.5 Palo Alto Unit 42 Aug 29, 2026

Palo Alto Unit 42 researchers have developed a technique called perturbation probing that identifies the precise feed-forward neurons responsible for LLM safety refusal behaviour, finding that as few as 50 neurons out of 350,208 control safety guardrails in Qwen3-4B. Disabling those neurons altered responses on 80% of tested harmful prompts, demonstrating that RLHF-aligned safety is structurally fragile rather than distributed. The research also introduces an FFN/Skip ratio metric that predicts model safety fragility across 13 models with 81% explanatory power, giving defenders a rapid quantitative tool for comparing alignment robustness.

Anthropic Claude Opus 4.6 Reveals Persistent Jailbreak Gaps in API

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.5 TechCrunch AI Aug 23, 2026

TechCrunch testing and an independent researcher have demonstrated that Anthropic's Claude Opus 4.6, Opus 3, and Haiku 4.5 models — all still available via the Anthropic API, Azure Foundry, and Amazon Bedrock — can be reliably coaxed into generating sexually explicit content through a multi-turn social engineering technique, despite Anthropic's universal usage policies prohibiting such output. The findings provide defenders and AI governance teams with a concrete, reproducible case study of how gradual escalation and social-manipulation jailbreaks bypass content safeguards in production-available models, closing a documentation gap around legacy model risk in multi-cloud deployments. Residual gaps remain around model deprecation policy, version-pinned API consumer risk, and the absence of runtime content enforcement independent of the model itself.

Encrypted Prompts Bypass Safety Guardrails in Grok and Gemini

ATLAS OWASP HIGH ▲ 8.5 SecurityWeek Aug 22, 2026

Researchers have disclosed a novel attack technique called 'Cryptographic Context Injection' that conceals malicious instructions within encrypted payloads, which are only decrypted inside a trusted execution environment — effectively hiding them from AI safety filters. The technique has been demonstrated against Grok and Gemini, two widely deployed commercial LLMs. This represents a significant escalation in prompt obfuscation methods, as it undermines content-level safety scanning by design.

LLM Reasoning Trace Theft via Encrypted Block Replay Attack

ATLAS OWASP HIGH ▲ 8.5 Simon Willison Aug 12, 2026

Researchers discovered that Anthropic, OpenAI, and Google share the same encryption key across model families for encrypted chain-of-thought blocks, allowing adversaries to replay stronger model reasoning traces into weaker siblings and extract hidden reasoning in plaintext via jailbreak. The attack also enables a prompt injection variant where malicious instructions embedded in reasoning traces are treated as trusted by the model, dramatically increasing attack success rates. All three vendors have since patched the vulnerability following responsible disclosure.

Moonshot AI Releases Kimi K3 Open-Weight 2.8T Model Weights

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 Simon Willison Jul 28, 2026

Moonshot AI has released the weights for Kimi K3, a 2.8 trillion parameter mixture-of-experts model (1.56TB), distributed under a restrictive 'open weight' licence that requires a separate commercial agreement for large MaaS operators. The public availability of weights at this scale materially lowers the barrier for adversarial fine-tuning, jailbreak research, and model-theft-adjacent supply chain attacks. Defenders deploying or downstream of K3 should assess licence compliance risk alongside the standard open-weight threat model.

AI Guardrails Fail Multilingual Jailbreak Tests in Europe

ATLAS OWASP HIGH ▲ 7.2 Dark Reading Jul 27, 2026

Research highlighted by Dark Reading reveals that AI safety guardrails and content filters are inconsistently applied across languages, leaving non-English speakers—particularly across Europe's multilingual landscape—with weaker protections against jailbreaking and unsafe model behaviour. This disparity suggests that safety training datasets and RLHF pipelines are disproportionately English-centric, creating exploitable blind spots. Adversaries aware of these gaps can trivially circumvent restrictions by switching input language.

Anthropic and OpenAI Open Vetted Cyber Programs for Offensive Researchers

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 TechCrunch AI Jul 24, 2026

Anthropic and OpenAI have introduced structured vetting programs — Anthropic's Cyber Verification Program and OpenAI's Trusted Access for Cyber — that grant approved offensive security researchers access to AI models with reduced cybersecurity guardrails. These programs create a two-tier access model where the boundary between legitimate researcher and malicious actor becomes a policy decision made by private companies, introducing new social-engineering and access-abuse vectors. Defenders must now account for the possibility that guardrail-reduced model access can be obtained through credential abuse, insider compromise, or vetting-process manipulation.

Threat Actor Trim Weaponises AI Jailbreaks for Offensive Ops

ATLAS OWASP HIGH ▲ 8.5 Dark Reading Jul 24, 2026

A Russian-speaking threat actor known as 'Trim' has reportedly operationalised frontier AI model jailbreaks, integrating them with offensive security tooling to create an attack platform. This marks a significant escalation from opportunistic jailbreaking to deliberate, weaponised misuse of large language models in adversarial operations. The development signals a maturing threat landscape where AI safety bypasses are no longer merely a research curiosity but a functional component of offensive cyber capability.

Alibaba and Baidu Launch LLMs With US-Level Capabilities

FIRST LOOK ATLAS OWASP HIGH ▲ 6.2 Dark Reading Jul 04, 2026

Two newly released large language models from Chinese AI firms have reached capability parity with leading US frontier models, expanding the global pool of powerful AI available to both commercial and adversarial users. For defenders, this development broadens the asymmetry between attackers — who gain access to capable, potentially less-restricted models — and defenders, who must now account for threats generated by a wider set of model providers. Security teams should anticipate increased use of these models for offensive tasks such as phishing content generation, vulnerability research automation, and social engineering at scale.

OpenAI Releases GPT-5.6 Sol for Vulnerability Research

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jun 29, 2026

OpenAI has released a limited preview of GPT-5.6 Sol, Terra, and Luna to select partners, positioning Sol as its most capable model for vulnerability research and exploit chain development, benchmarked against real-world hardened targets via an internal framework called VulnLMP. The model's demonstrated ability to produce credible memory safety leads and automate substantial portions of vulnerability research pipelines materially lowers the barrier for both defenders and adversaries. Security teams should expect accelerated attacker timelines for exploit development and increased pressure on detection and patch-deployment cadences.

Anthropic Releases Claude Mythos 5 Under U.S. Export Controls

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 Anthropic (via HN) Jun 27, 2026

The U.S. Commerce Department has lifted export controls on Anthropic's Claude Mythos 5, permitting access to over 100 vetted U.S. institutions and government agencies under a nascent federal AI licensing regime. For defenders, this tiered-release model introduces a new class of risk: the 'trusted partner' designation becomes a high-value target, as compromise of any listed entity grants implicit legitimacy to interact with a model previously deemed too dangerous for general release. Security teams at approved organizations should treat Mythos 5 access credentials and API endpoints as critical assets, and assume adversaries will probe the boundary between licensed and unlicensed access patterns.

LLM Role Confusion Attack Bypasses Safety at 61%

ATLAS OWASP HIGH ▲ 8.2 Simon Willison Jun 23, 2026

New research from Ye, Cui, and Hadfield-Menell demonstrates that LLMs prioritise the stylistic format of text over its structural role tags, enabling attackers to craft injected content that mimics internal reasoning blocks and bypasses safety guardrails. The study found attack success rates of 61% when injected text stylistically matched model-internal formats, dropping to just 10% after 'destyling'. The authors conclude that without genuine role perception in models, prompt injection defences will remain fundamentally reactive.

OpenAI's ChatGPT Image Generation Fails Content Moderation

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 OpenAI (via HN) Jun 22, 2026

Mindgard researchers demonstrated that ChatGPT's image generation pipeline can be manipulated through an indirect, socially-engineered prompt to produce violent and sexually explicit content without users directly requesting it, exposing a significant failure in OpenAI's content moderation controls. Defenders and enterprise operators of ChatGPT-integrated products face a newly validated attack class where innocuous-looking prompt patterns — potentially spreading virally — can systematically strip safety guardrails from image generation. This finding signals that content filter bypasses in multimodal systems are reproducible at scale, raising urgent questions about the adequacy of output-layer filtering as a sole defence mechanism.

Jailbreak

Stay ahead of the threat.